IOC Report
LXoASvZRu1.exe

loading gif

Files

File Path
Type
Category
Malicious
LXoASvZRu1.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\DBKEGCAE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\DBKEGCAEGIIJKFIEHIJEGIJEHJ
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DQOFHVHTMG.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\FBFHDBKJEGHJJJKFIIJE
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FENIVHOIKN.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\FENIVHOIKN.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\HTAGVDFUIE.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\IDHDGDHJEGHIDGDHCGCBAKFHII
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IPKGELNTQY.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\JDHJKKFBAEGDGDGCBKEC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JKKFIIEB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\KFHJJJKKFHIDAAKFBFBFCGDGDB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\LTKMYBSEYZ.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_LXoASvZRu1.exe_f721a4370679dc645e7a5c0bf1638c7df829a4b_73d556b8_38a2212c-a742-4d16-b53d-b0143857f458\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D3.tmp.dmp
Mini DuMP crash report, 14 streams, Thu Apr 18 04:42:47 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FD.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER71D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\NWTVCDUMOB.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ONBQCLYSPU.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\ONBQCLYSPU.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\PIVFAGEAAV.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\PIVFAGEAAV.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\UMMBDNEQBN.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\UMMBDNEQBN.xlsx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\VLZDGUKUTZ.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\XZXHAVGRAG.docx
ASCII text, with very long lines (1024), with CRLF line terminators
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped
There are 32 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LXoASvZRu1.exe
"C:\Users\user\Desktop\LXoASvZRu1.exe"
 malicious
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7284 -s 2052

URLs

Name
IP
Malicious
http://185.172.128.23/8e6d9db21fb63946/nss3.dll
185.172.128.23
 malicious
http://185.1
unknown
 malicious
185.172.128.23/f993692117a3fda2.php
malicious
http://185.172.128.23/f993692117a3fda2.php
185.172.128.23
 malicious
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dll
185.172.128.23
 malicious
http://185.172.128.23/8e6d9db21fb63946/mozglue.dll
185.172.128.23
 malicious
http://185.172.1
unknown
 malicious
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll
185.172.128.23
 malicious
http://185.172.128.23/f993692117a3fda2.p
unknown
 malicious
http://185.172.128.23/8e6d9db21fb63946/softokn3.dll
185.172.128.23
 malicious
http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dll
185.172.128.23
 malicious
http://185.172.128.23
unknown
 malicious
http://185.172.128.23/8e6d9db21fb63946/freebl3.dll
185.172.128.23
 malicious
http://185.172.128.23/f993692117a3fda2.phpt
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://185.172.128.23/f993692117a3fda2.php0c0be7177fbbc45272aee119d6a5d
unknown
http://185.172.128.23/f993692117a3fda2.phpx
unknown
https://duckduckgo.com/ac/?q=
unknown
http://185.172.128.23/8e6d9db21fb63946/vcruntime140.dllA
unknown
http://185.172.128.23/f993692117a3fda2.pX
unknown
http://185.172.128.23/f993692117a3fda2.phpts
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://185.172.128.23/f993692117a3fda2.phpl
unknown
http://185.172.128.2n
unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dllq
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dll-
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://185.172.128.23/f993692117a3fda2.php8
unknown
http://185.172.128.23/f993692117a3fda2.php7
unknown
https://mozilla.org0/
unknown
http://185.172.128.23/8e6d9db21fb63946/mozglue.dllQ
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://185.172.128.23/8e6d9db21fb63946/sqlite3.dllC
unknown
http://185.172.128.23/f993692117a3fda2.php5$6
unknown
http://185.172.128.23/f993692117a3fda2.phpA
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://upx.sf.net
unknown
http://185.172.128.23/f993692117a3fda2.php(
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://185.172.128.23/8e6d9db21fb63946/msvcp140.dllc
unknown
http://185.172.128.23/f993692117a3fda2.php)
unknown
https://www.ecosia.org/newtab/
unknown
http://185.172.128.23/8e6d9db21fb63946/freebl3.dllg
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://185.172.128.23/f993692117a3fda2.php0
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
There are 44 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.172.128.23
unknown
Russian Federation
malicious

Registry

Path
Value
Malicious
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
ProgramId
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
FileId
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
LowerCaseLongPath
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
LongPathHash
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
Name
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
OriginalFileName
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
Publisher
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
Version
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
BinFileVersion
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
BinaryType
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
ProductName
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
ProductVersion
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
LinkDate
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
BinProductVersion
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
AppxPackageFullName
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
AppxPackageRelativeId
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
Size
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
Language
\REGISTRY\A\{c8418c0d-4f39-368d-a6d6-a2d93e82c301}\Root\InventoryApplicationFile\lxoasvzru1.exe|a983df64a1afe148
Usn
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
ClockTimeSeconds
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
TickCount
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2EB0000
direct allocation
page execute and read and write
 malicious
3086000
heap
page read and write
 malicious
2EE0000
direct allocation
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
624000
unkown
page execute and read and write
30B5000
heap
page read and write
2340B000
heap
page read and write
2341B000
heap
page read and write
234EB000
heap
page read and write
4BBB000
heap
page read and write
2341B000
heap
page read and write
23400000
heap
page read and write
233F0000
heap
page read and write
2341B000
heap
page read and write
6CD7E000
unkown
page read and write
23400000
heap
page read and write
307DB000
heap
page read and write
3050000
heap
page read and write
233E3000
heap
page read and write
6CD91000
unkown
page execute read
61ED3000
direct allocation
page read and write
3083000
heap
page read and write
2341B000
heap
page read and write
233F7000
heap
page read and write
1D371000
heap
page read and write
233F3000
heap
page read and write
400000
unkown
page readonly
233FC000
heap
page read and write
61EB7000
direct allocation
page readonly
6CF6F000
unkown
page write copy
2F27000
heap
page read and write
6CD82000
unkown
page readonly
23400000
heap
page read and write
29490000
heap
page read and write
6CD90000
unkown
page readonly
6CF70000
unkown
page read and write
2F740000
heap
page read and write
2341A000
heap
page read and write
1D470000
trusted library allocation
page read and write
61E01000
direct allocation
page execute read
23416000
heap
page read and write
302CA000
heap
page read and write
1D474000
heap
page read and write
1D370000
heap
page read and write
401000
unkown
page execute read
2341B000
heap
page read and write
29533000
heap
page read and write
2340D000
heap
page read and write
41A000
unkown
page readonly
6CD6D000
unkown
page readonly
61ECC000
direct allocation
page read and write
29624000
heap
page read and write
2D1C000
unkown
page readonly
61ED4000
direct allocation
page readonly
6CF6E000
unkown
page read and write
1D0AE000
stack
page read and write
2EAE000
stack
page read and write
2340E000
heap
page read and write
233FD000
heap
page read and write
23413000
heap
page read and write
233F7000
heap
page read and write
233F7000
heap
page read and write
233E6000
heap
page read and write
448000
unkown
page execute and read and write
233F3000
heap
page read and write
2F27000
heap
page read and write
29624000
heap
page read and write
192000
stack
page read and write
1CCCE000
stack
page read and write
61ECD000
direct allocation
page readonly
2F25000
heap
page read and write
197000
stack
page read and write
305A000
heap
page read and write
1CC8F000
stack
page read and write
294F1000
heap
page read and write
233E6000
heap
page read and write
49EF000
stack
page read and write
233FA000
heap
page read and write
29616000
heap
page read and write
1D371000
heap
page read and write
30CE0000
heap
page read and write
424000
unkown
page write copy
23488000
heap
page read and write
2340E000
heap
page read and write
6CF75000
unkown
page readonly
233E0000
heap
page read and write
23413000
heap
page read and write
2961E000
heap
page read and write
233FC000
heap
page read and write
61ED0000
direct allocation
page read and write
2EE0000
heap
page read and write
233F3000
heap
page read and write
233F6000
heap
page read and write
233F7000
heap
page read and write
2D1C000
unkown
page readonly
2341B000
heap
page read and write
2D1B000
unkown
page read and write
233ED000
heap
page read and write
2961C000
heap
page read and write
23411000
heap
page read and write
233FB000
heap
page read and write
233FC000
heap
page read and write
6CCF1000
unkown
page execute read
233F8000
heap
page read and write
23419000
heap
page read and write
4B4F000
stack
page read and write
306E000
heap
page execute and read and write
636000
unkown
page execute and read and write
61E00000
direct allocation
page execute and read and write
233F7000
heap
page read and write
1D1FE000
stack
page read and write
4BB0000
heap
page read and write
19B000
stack
page read and write
6CF2F000
unkown
page readonly
233F3000
heap
page read and write
233E7000
heap
page read and write
1CF5E000
stack
page read and write
2340E000
heap
page read and write
1D2FE000
stack
page read and write
233E6000
heap
page read and write
4B8E000
stack
page read and write
1CDCF000
stack
page read and write
302E000
stack
page read and write
1D360000
heap
page read and write
305E000
heap
page read and write
29470000
heap
page read and write
2F650000
trusted library allocation
page read and write
9B000
stack
page read and write
44B000
unkown
page execute and read and write
2E5E000
stack
page read and write
2341B000
heap
page read and write
49F0000
heap
page read and write
1F0000
heap
page read and write
1D1AE000
stack
page read and write
233F7000
heap
page read and write
233E6000
heap
page read and write
23400000
heap
page read and write
233E6000
heap
page read and write
4A4E000
stack
page read and write
23422000
heap
page read and write
29537000
heap
page read and write
233FD000
heap
page read and write
2341C000
heap
page read and write
2F20000
heap
page read and write
61EB4000
direct allocation
page read and write
233FC000
heap
page read and write
233E7000
heap
page read and write
2E10000
heap
page read and write
1D05D000
stack
page read and write
23400000
heap
page read and write
1CF0F000
stack
page read and write
302C0000
heap
page read and write
29450000
heap
page read and write
549000
unkown
page execute and read and write
23413000
heap
page read and write
233FB000
heap
page read and write
1CE0E000
stack
page read and write
6CCF0000
unkown
page readonly
2952D000
heap
page read and write
30D9000
heap
page read and write
42A000
unkown
page write copy
233F6000
heap
page read and write
23419000
heap
page read and write
2340E000
heap
page read and write
23400000
heap
page read and write
233F6000
heap
page read and write
23419000
heap
page read and write
313B000
heap
page read and write
There are 158 hidden memdumps, click here to show them.